noa-receipt/dist/src/pii.js

NOA Agent Action Receipt — open, offline-verifiable provenance for AI-agent actions. The governance/receipt organ only; the NOA brain is separate and proprietary.

import { createHmac } from "node:crypto";
const APPROVER_ID_DOMAIN = "noa-receipt/approver-id/v1";
const SEP = String.fromCharCode(0);
function normalizeIdentifier(raw) {
    const s = raw.trim().toLowerCase();
    const at = s.indexOf("@");
    if (at > 0 && s.indexOf("@", at + 1) === -1) {
        const local = s.slice(0, at);
        const domain = s.slice(at + 1);
        const plus = local.indexOf("+");
        const cleanLocal = plus <= 0 ? local : local.slice(0, plus);
        return `${cleanLocal}@${domain}`;
    }
    return s;
}
export function opaqueApproverId(identifier, tenant = null) {
    if (typeof identifier !== "string" || identifier.length === 0) {
        throw new Error("opaqueApproverId: identifier must be a non-empty string");
    }
    const key = `${APPROVER_ID_DOMAIN}${SEP}${tenant ?? ""}`;
    const hex = createHmac("sha256", key).update(normalizeIdentifier(identifier), "utf8").digest("hex");
    return `hmac-sha256:${hex}`;
}